Beame Gatekeeper

Operation Manual

Beame Gatekeeper

Installation

System Requirements

Installing the Gatekeeper package

Getting Registration Token

Boot and run

Setting Gatekeeper as system service

Setting Gatekeeper as regular app

Gatekeeper Configuration

Admin Console

Accessing the console

Gatekeeper Dashboard

Service name

The name of the Gatekeeper - can also be set by CLI in OS shell

Registration method

Environment Mode

Allow Public Registration

Use Image Authentication

Encrypt User Data

Invitations

Create Invitation

Upload Invitations CSV

Invitations Report

Creds

Creds Tree

Share Cred

Cred Actions

Add DNS

Users

Registrations

Services

VPN

Beame-Gatekeeper CLI

Beame-gatekeeper-ctl

Beame-gatekeeper

Installation

Instructions can be found at beame-gatekeeper npm page as well

See this video on how to install Beame Gatekeeper on Kali Linux

System Requirements

Npm 6.4.1 or newer, Nodejs 8.X

Windows (find detailed Windows requirements here):

        Ensure that you run installation as administrator

Install Node.js from https://nodejs.org/en/download/

Linux (may require “sudo”):

        apt-get install npm

        apt-get install nodejs

        To install specific version:

        curl -sL https://deb.nodesource.com/setup_8.x | sudo bash -

Mac OS (installation video):

        brew install npm

To update:

        brew update

        brew upgrade node

Installing the Gatekeeper package

Install the Gatekeeper application from npm package (requires root access, so use “sudo” if needed):

Raspbian:         npm install beame-gatekeeper -g --unsafe-perm

Others:        npm install -g beame-gatekeeper

Note: unsafe-perm switch sometimes may be required even when running as root

Getting Registration Token

1. Navigate to https://start.beameio.net
2. Prove you’re not a bot by passing a captcha
3. Type in your name and email
4. Accept User Agreement and email with token will be sent to the email address you provided

Boot and run

Setting Gatekeeper as system service

Use command from registration email (don’t forget “sudo” if needed)

MacOS:         beame-gatekeeper-install-launchd <token> 

Linux:         beame-gatekeeper-install-systemd <token>

The advantages are:

• Gatekeeper will run as a less privileged, no-shell user: beame-gatekeeper (_beame-gatekeeper on Mac)
• All the provisioning of credentials will be performed under that user, without touching your own home directory
• Beame-gatekeeper will be installed as a system service, so no need to start it manually on system reboot

Setting Gatekeeper as regular app

This is the only available Gatekeeper configuration for Windows in current release

Use token from registration email, you’ll need root privileges if you installed npm package with “-g” option.

Any OS: beame-gatekeeper creds getCreds --regToken <token>

To run is as regular application: beame-gatekeeper server start

Gatekeeper Configuration

Admin Console

Accessing the console

To open Gatekeeper admin console for the first time, ensure that your Gatekeeper is running and use the token, that was printed at the end of installation, or generate a new one:

        beame-gatekeeper-ctl admin

OR

        beame-gatekeeper creds admin

Copy-paste the token to your web-browser address bar and press enter.

Be aware, verified browsers are: Firefox, Chrome, Opera, Edge

Gatekeeper Dashboard

• Service name

• The name of the Gatekeeper - can also be set by CLI in OS shell

• Registration method

• Pairing - register by scanning a QR
• Email(*required for SSO) - register by opening registration link on a mobile device with Beame Authenticator installed

• Environment Mode

• Gatekeeper - main mode of work
• Central Login - to be used as a router for any other Gatekeeper
• Delegated Login Master - to be used as a router for pre-defined Gatekeeper(s)

• Allow Public Registration

• Permits direct access to Gatekeeper’s registration page (other options are controlled by the Admin)

• Use Image Authentication

• If set, makes registration process to require User Image as a part of identification, the image further is signed by Gatekeeper and stored in sandbox on Mobile device, accessible only from within Authenticator to be used as additional authentication factor

• Encrypt User Data

• If set, all data provided by user upon identification (name, email, ID) is encrypted by Gatekeeper and stored in app sandbox on Mobile device as encrypted block (*required for SSO)

Invitations

Used to create registration invitations, to allow a User to get a credential to access Gatekeeper’s services/applications. The invitation is to be opened on mobile device with Beame Authenticator app installed

• Create Invitation

• Issue single invitation to Email optionally providing Name and External User ID

• Upload Invitations CSV

• Issue invitation bundle to Emails optionally providing Names and User IDs, file format:

• Name, email@example.io, userId
• , email1@example.io, userId1

• Invitations Report

• Invitation data, date of issuance and status (Waiting/Cancelled/Completed)

Creds

Tools to manage certificates. Create new creds, build and manage groups & trees. Register a hostname in DNS.

• Creds Tree

• Creds are displayed on the left pane in tree structure, choose a cred to work with

• Share Cred

• Choose a way to transfer a Pfx you created (in current release password will be sent along with the Pfx)

• Cred Actions

• Create Child - create a new cred under the selected one (the new cred will appear underneath the parent in tree)
• Create Invitation - create invitation for new cred creation under the selected one, and send it by email or display a QR (both to be opened/scanned by Beame Authenticator app)
• Create Registration Token - create a token to use in Beame-CLI run (beame-gatekeeper creds getCreds --regToken token) this will create a new cred and save it under local Beame folder ~/.beame/v2
• Cert Actions - manage the certificate of selected cred

• Add DNS

• Mark Beame edge to use Beame tunneling service or provide Custom IP address/CN if you have public IP

Users

Manage Users of your Gatekeeper.

Make any User a Admin.

Make a User Active/Inactive by setting corresponding value in ACTIVE field

Export a User list

Registrations

Status and data of all registrations in your Gatekeeper.

Services

Define applications and services that your Gatekeeper provides to authenticated Users. See how it is easily done in this “Hello World” video

Code - any unique string, there are several stored names, that are processed by the Gatekeeper in a different manner

Name - meaningful name, to be displayed to a User

URL - where the application/service is running

Active - turn the application availability on/off

VPN

Beame Gatekeeper supports StrongSwan VPN. Create mobile VPN profile and scan the QR with any scanner of your mobile device. Import the profile and credential to your mobile. See this guide for detailed instructions

Beame-Gatekeeper CLI

Beame-gatekeeper-ctl

Use if the Gatekeeper installed as a system service

Beame-gatekeeper

Use if the Gatekeeper installed as a regular app

  beame-gatekeeper creds getCreds [--regToken regToken] [--fqdn fqdn]- create new Cred with regToken

  beame-gatekeeper creds list [--regex regex] [--format {text|json}] - list Creds that are found on local machine

  beame-gatekeeper creds listVpnCreds --fqdn fqdn --vpnId vpnId [--format {text|json}]- list Creds related to vpnId

  beame-gatekeeper creds createServersCredentials - initial Gatekeeper creds acquisition

  beame-gatekeeper creds webToken --type {config|admin|app} [--appId appId] [--format {text|json}] - get link with token, copy-paste to a browser

  beame-gatekeeper creds admin [--format {text|json}]- shortcut to get admin link with token

  beame-gatekeeper config init - validate Gatekeeper configuration

  beame-gatekeeper config setName --name name - rename the Gatekeeper

   beame-gatekeeper server start